Skip to main content

Security Group Sync Service Principal

Administrator

DataCentral can automatically sync the members of an Entra ID Security Group into a DataCentral Organizational Unit (OU). To do this without requiring highly privileged permissions on the logged-in user, you configure a dedicated Security Group Sync Service Principal.

This is the recommended approach for OU sync, as it is more secure than using the Authentication + Power BI + Security Groups permission level — the service principal handles group management independently rather than relying on elevated permissions from the authenticated user.

1. Register an Application in Entra ID​

  1. Log in to the Azure portal.
  2. Navigate to Microsoft Entra ID > App registrations.
  3. Click New registration.
  4. Provide a name (e.g., DataCentral Security Group Sync) and click Register.
  5. Copy the Application (client) ID and Directory (tenant) ID from the Overview tab.
  6. Go to Certificates & secrets, click New client secret, and copy the Value immediately.

2. Configure API Permissions​

  1. In the App Registration, go to API permissions.
  2. Click Add a permission > Microsoft Graph > Application permissions.
  3. Add User.ReadBasic.All.
  4. Click Grant admin consent for your organisation.

3. Grant Group Access​

There are two ways to allow the service principal to manage group membership:

Making the service principal an Owner of each security group is the recommended least-privilege approach. As an owner, it can only read and manage members of the specific groups it owns — it cannot enumerate or access other groups in your directory.

  1. In the Entra admin center, navigate to Groups and open the security group.
  2. Go to Owners and click Add owners.
  3. Search for the service principal by the name of the app registration and add it.

Repeat this for each security group you intend to sync with DataCentral OUs.

Option B: Grant Application Permissions​

Alternatively, you can grant the service principal tenant-wide permissions instead of making it a group owner. This gives it full control over group membership across your entire directory, so it is less restricted but requires no per-group configuration.

Add the following Application permissions in addition to User.ReadBasic.All:

  • Group.Read.All
  • GroupMember.ReadWrite.All

Click Grant admin consent after adding these permissions.

note

With this approach the service principal can read and modify membership of any group in your tenant. Use Option A if you want to limit its visibility and access to specific groups only.

4. Configure DataCentral​

  1. Navigate to Administration > Entra Security Group Sync.
  2. Enter the following credentials from your App Registration:
    • Client ID
    • Client Secret
  3. Click Save.

Once configured, you can link security groups to Organizational Units from the OU settings. DataCentral will use this service principal to read group membership and sync users into the corresponding OU.